Bug 238349 – AI should not set the structure for ObjectCreate

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Justin Michaud]

The AbstractInterpreter should not set the structure for ObjectCreate because it might change by the time the constant folding phase runs if the structure cache is cleared.

[Justin Michaud]

Created attachment 455689 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 455689 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455689&action=review

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:-3147
> -                setForNode(node, structure);

We should continue setting a structure for nullPrototypeObjectStructure.

[Saam Barati]

Comment on attachment 455689 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455689&action=review

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3138
>                  break;

You can’t break here. You need the below code to run and set our type.

I also suggest reworking this patch to never even bother looking up a structure and just always mark things as shoyldTryCobstantFolding or instead to keep the code as it used to be

[Radar WebKit Bug Importer]

<rdar://problem/90842529>

[Mark Lam]

<rdar://problem/90838071>

[Justin Michaud]

Created attachment 455790 [details]
Patch

[Yusuke Suzuki]

Why not moving StructureCache from VM to JSGlobalObject?
This cache is used for objects' structures. Thus each structure has its tied JSGlobalObject.

[Saam Barati]

Comment on attachment 455790 [details]
Patch

We're discussing on slack a better approach

[Justin Michaud]

Created attachment 455795 [details]
Patch

[Saam Barati]

Comment on attachment 455795 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455795&action=review

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3131
> -                    didFoldClobberWorld();
> +                    clobberWorld();

this shouldn't change.

[Justin Michaud]

Created attachment 455796 [details]
[fast-cq] Patch

[Saam Barati]

Comment on attachment 455796 [details]
[fast-cq] Patch

r=me

[Yusuke Suzuki]

r=me too.

[Mark Lam]

Patch landed in r291891: <http://trac.webkit.org/r291891>.